Dapr 1.18 Adds Cryptographic Trust Layer for AI Agents and Workflows

Diagrid has released Dapr 1.18, rolling out Verifiable Execution—a framework for cryptographically signing and verifying workflow histories in distributed systems and AI agents.

The Problem: Trust in Autonomous Systems#

As AI agents handle increasingly critical decisions—approving transactions, accessing sensitive data, or invoking other agents—organizations face a fundamental challenge: proving how those decisions were made. Traditional workflow engines excel at durability and fault tolerance, but they lack built-in mechanisms for provenance and accountability.

Regulators and business stakeholders now demand answers to questions like: Who initiated an action? Has the execution history been altered? Can downstream systems trust the results?

Three New Capabilities#

Dapr 1.18 introduces three interconnected features:

• Workflow History Signing: Uses open SPIFFE identity standards to cryptographically sign execution records, making them tamper-evident and independently verifiable.
• Workflow History Propagation: Extends execution lineage across service and workflow boundaries, so downstream systems understand request origins and prior actions.
• Workflow Attestation: Provides workflows with trusted execution context, enabling policies and compliance checks based on verified provenance.

Together, these create an immutable audit trail of who did what, when—mirroring supply chain security practices (SBOMs, artifact attestations) but applied to runtime execution rather than software artifacts.

Broader Industry Shift#

The release reflects growing industry focus on AI governance. Organizations like Microsoft, the Agentic AI Foundation (AAIF), and the Cloud Native Computing Foundation (CNCF) are increasingly emphasizing identity, provenance, and cryptographic accountability as foundational for agent-based systems.

Additional Updates#

Dapr 1.18 also stabilizes the for scheduling recurring work, introduces for zero-downtime updates, and adds . The Actor runtime model now supports bidirectional gRPC streams, eliminating the need for exposed inbound ports and reducing attack surface.